search

containers / image

Work with containers' images
Apache License 2.0
843 stars 365 forks source link

Quote various strings coming from untrusted sources #2408

Closed mtrmac closed 1 month ago

mtrmac commented 1 month ago

Typically, use %q instead of %s (or instead of "%s"), to expose various control characters and the like without interpreting them.

This is not really comprehensive; the codebase makes no general guarantee that any returned string values are free of control characters or other malicious/misleading metadata. Not even in returned "error" values (which can legitimately contain newlines, if nothing else).

A side effect of the code audit required by CVE-2024-3727 .

mtrmac commented 1 month ago

See https://github.com/containers/skopeo/pull/2325 for updated Skopeo tests.

rhatdan commented 1 month ago

LGTM

rhatdan commented 1 month ago

Skopeo tests need to be updated.

mtrmac commented 1 month ago

There is a link to an updated version above.